AboutFree templates
How-to · AWS

Install AWS CLI version 2 and configure credentials

At the end you will have the aws command installed, a working profile signed in through IAM Identity Center (or access keys), and proof of which account and role you are using. If you cannot install software, use AWS CloudShell.

Updated 9 steps6 official sources
Start hereBack to the playbook
Before you start

What you need before step 1

Applies to: AWS CLI version 2 on 64-bit Windows, macOS 11 or later, and Linux x86_64 or ARM (aarch64), as documented by AWS

Admin roles you need

  • Local administrator on Windows for the all-users MSI (AWSCLIV2.msi). The current-user MSI (AWSCLIV2-User.msi) does not need admin rights
  • sudo on macOS or Linux for an all-users install
  • For aws configure sso: access to an IAM Identity Center permission set in the target account. AWS suggests the predefined PowerUserAccess permission set unless your organisation has created its own
  • For aws configure: an IAM user access key (AWS marks long-term credentials as not recommended)

Licences

None needed.

Download

AWS CLI MSI for Windows (64-bit, all users)Current-user installer without admin rights: https://awscli.amazonaws.com/AWSCLIV2-User.msihttps://awscli.amazonaws.com/AWSCLIV2.msiDownload
AWS CLI package for macOSmacOS 11 and laterhttps://awscli.amazonaws.com/AWSCLIV2.pkgDownload
AWS CLI for Linux x86_64ARM: https://awscli.amazonaws.com/awscli-exe-linux-aarch64.ziphttps://awscli.amazonaws.com/awscli-exe-linux-x86_64.zipDownload

Install instructions

Installing or updating to the latest version of the AWS CLI (AWS docs)Full instructions for every platformhttps://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.htmlInstall steps

Also have ready

  • For SSO: your AWS access portal start URL (for example https://my-sso-portal.awsapps.com/start) and the Region where IAM Identity Center runs
  • Linux: glibc, groff, less and unzip installed
Step by step

9 steps

  1. 1

    Install on Windows

    Where: Windows PC: right-click Start and select Terminal (Admin), or run Command Prompt as administrator

    Run the MSI straight from the AWS URL. Follow the installer prompts. If you do not have admin rights, use the current-user MSI instead (second line).

    msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2-User.msi
    You should see: The AWS Command Line Interface v2 setup wizard opens and completes.
  2. 2

    Or install on macOS

    Where: Mac: Finder > Applications > Utilities > Terminal

    Either download https://awscli.amazonaws.com/AWSCLIV2.pkg, open it and follow the on-screen instructions, or run the two commands below to install for all users.

    curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /
    You should see: The installer reports success. Install logs are written to /var/log/install.log.
  3. 3

    Or install on Linux

    Where: Linux terminal (bash). Use the aarch64 zip on ARM machines

    Download the zip, unzip it and run the installer with sudo. When updating an existing install, use unzip -u to skip the overwrite prompts.

    curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
    You should see: The installer finishes without errors and aws --version (next step) returns a Linux version string.
  4. 4

    Check the version

    Where: A new terminal window (close and reopen it on Windows to refresh PATH)

    Type the command below.

    aws --version
    You should see: A line such as aws-cli/2.27.41 Python/3.11.6 Windows/10 exe/AMD64 prompt/off. Your version number will be newer.
  5. 5

    Configure IAM Identity Center sign-in (recommended)

    Where: The same terminal window

    Run aws configure sso and answer the prompts: a session name, your start URL, the SSO Region and sso:account:access for scopes. Your browser opens; approve the request (the client name starts with botocore-client-). Back in the terminal pick the account and role, then set the default Region, output format and a profile name.

    aws configure sso
# SSO session name (Recommended): contoso-sso
# SSO start URL [None]: https://my-sso-portal.awsapps.com/start
# SSO region [None]: us-east-1
# SSO registration scopes [None]: sso:account:access
# Default client Region [None]: ap-southeast-2
# CLI default output format (json if not specified) [None]: json
# Profile name [123456789011_ReadOnly]: contoso-admin
    You should see: A [profile contoso-admin] section and an [sso-session contoso-sso] section are written to the config file in the .aws folder in your home directory.
  6. 6

    Or configure access keys (long-term credentials)

    Where: The same terminal window

    Only if your organisation does not use IAM Identity Center. AWS labels long-term credentials "Not recommended". Run aws configure and paste your access key ID and secret access key, then a default Region and output format.

    aws configure
# AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name [None]: ap-southeast-2
# Default output format [None]: json
    You should see: The command returns to the prompt. The credentials and config files are saved in the .aws folder in your home directory (%UserProfile% on Windows, ~ on macOS and Linux).
  7. 7

    Confirm who you are signed in as

    Where: The same terminal window

    Run the command below (drop --profile if you used aws configure or named the SSO profile default).

    aws sts get-caller-identity --profile contoso-admin
    You should see: JSON showing "UserId", "Account" (your 12-digit account ID) and "Arn" for the role or user you expect.
  8. 8

    Sign in again when the SSO session expires

    Where: The same terminal window

    SSO credentials expire and you must renew them by signing in again.

    aws sso login --profile contoso-admin
    You should see: Successfully logged into Start URL: https://my-sso-portal.awsapps.com/start
  9. 9

    Use AWS CloudShell if you cannot install anything

    Where: AWS Management Console > CloudShell icon on the navigation bar (or in the console footer)

    AWS describes CloudShell as a browser-based, pre-authenticated shell with the AWS CLI preinstalled. The credentials you used to sign in to the console are available automatically, so you do not run aws configure.

    aws sts get-caller-identity
    You should see: A shell opens in the browser and returns your console identity.
From experience

Expert tips

Use one SSO session for many profiles

Define an [sso-session] block once and point several profiles at it with sso_session, one per account or role. One aws sso login then covers them all, and AWS says the CLI renews the role credentials automatically while the IAM Identity Center session is valid.

Always name the profile and check it first

Before anything that changes resources, run aws sts get-caller-identity --profile <name> and check the account ID. Working in the wrong account is the most common and most expensive CLI mistake during a migration.

Set the region per profile

Many "resource not found" errors are simply the wrong region. Set a region for each profile, or change it with aws configure set region ap-southeast-2 --profile <name>, so commands land where your migration target is.

Sign in from servers without a browser

From version 2.22.0 the CLI uses PKCE sign-in by default, which needs a browser on the same machine. On a jump host or server, use aws sso login --profile <name> --use-device-code and open the URL on your own computer.

Clean up credentials when you finish

Run aws sso logout to delete cached SSO credentials (stored under ~/.aws/sso/cache). If you used long-term access keys for a migration, remove them from ~/.aws/credentials and deactivate them in IAM when the project ends.

Check it worked

How to confirm it worked

  • aws --version returns aws-cli/2.x.x.

  • aws sts get-caller-identity --profile contoso-admin returns the account ID and role ARN you expect.

  • On macOS, which aws returns /usr/local/bin/aws.

Undo

How to reverse it

Rollback:

Sign out of SSO with aws sso logout ("Successfully signed out of all SSO profiles."). Delete any access key you created in the IAM console. To remove saved settings, delete the .aws folder in your home directory. To remove the CLI on Windows, uninstall AWS Command Line Interface v2 from Settings > Apps > Installed apps; for macOS and Linux follow the uninstall section of the AWS install page.

Troubleshooting

Errors you might see

aws: command not found / 'aws' is not recognized

Cause: The terminal was open during installation and has not picked up the new PATH.

Fix: Close and reopen the terminal. If it persists, see "Command not found errors" in AWS's CLI troubleshooting guide.

aws --version returns a different version than you installed

Cause: An older copy of the CLI (for example a version 1 install) appears earlier in PATH.

Fix: Follow AWS's troubleshooting section for this message and remove the older install. On Amazon Linux run sudo yum remove awscli before the first update.

aws --version still returns a version after uninstalling the AWS CLI

Cause: Another copy of the CLI remains on the system or in PATH.

Fix: Follow the matching section of AWS's CLI troubleshooting guide to find and remove the remaining copy.

Browser does not open during aws configure sso (symptom)

Cause: No default browser is available, for example over SSH.

Fix: The CLI prints a URL to open manually. Or rerun with --use-device-code, open the URL shown on another device and enter the code.

Commands fail after a few hours with an SSO profile (symptom)

Cause: IAM Identity Center credentials have expired; AWS says you must renew them explicitly.

Fix: Run aws sso login --profile contoso-admin again.

FAQ

Questions

How do I update AWS CLI v2?

From version 2.36.0 you can run aws update (from an elevated shell for all-users installs). You can also rerun the installer.

Should I use aws configure or aws configure sso?

AWS recommends federation through IAM Identity Center over long-term IAM user keys. Use aws configure sso when your organisation has Identity Center.

Where does the AWS CLI store credentials?

In the credentials and config files in the .aws folder in your home directory. You can change the location with AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.

Can I install without admin rights?

Yes. On Windows use AWSCLIV2-User.msi. On Linux run ./aws/install -i /usr/local/aws-cli -b /usr/local/bin with folders you can write to.

Sources

Official sources

Vendors change menus and requirements. Confirm on the source before you rely on a detail. Last checked 4 Nov 2026.

AWS: Installing or updating to the latest version of the AWS CLIAWS: Setting up the AWS CLIAWS: Configuring IAM Identity Center authentication with the AWS CLIAWS: STS examples using AWS CLI (get-caller-identity)AWS: What is AWS CloudShell?AWS: Launching AWS CloudShell from the navigation bar